Ruan writes in his book in chapter 4 "The Engine: Safeguarding Itself before Safeguarding Others":
"In addition, there is a basic guideline for realizing security: Never rely on security through obscurity. When designing security hardening features for the engine, it is always assumed that all firmware source code and internal architecture documentation may be obtained by attackers. The engine’s security design principle is to harden the product by applying proven cryptography and security primitives, rather than rely on hiding secrets in the code or documents."
So they cast their secrets in silicon I guess, which would be incomparably harder to recover.
"In addition, there is a basic guideline for realizing security: Never rely on security through obscurity. When designing security hardening features for the engine, it is always assumed that all firmware source code and internal architecture documentation may be obtained by attackers. The engine’s security design principle is to harden the product by applying proven cryptography and security primitives, rather than rely on hiding secrets in the code or documents."
So they cast their secrets in silicon I guess, which would be incomparably harder to recover.